All vulnerabilities
CVE-2026-97859GHSA-xvfh-qwmh-f92w

Gitea API disclosure of private user social graph, keys and stars

Gitea Gitea
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.27.3Fixed versionGitHub
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 1.27.3gitea.dev, goGitHubgo get gitea.dev@v1.27.3

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Seven Gitea API routes under /api/v1/users/{username} (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the followers, following list, starred and watched repositories and public SSH and GPG keys of a user with limited or private visibility, whom they could not otherwise see. The issue was fixed in 1.27.3 and 28.0.0 and disclosed with 28.2.0.

Text from CVE List

Affected versions 2

  • Giteaaffected: all versions through 1.27.2CVE List
  • gitea.dev, go<= 1.27.2GitHub

References 5